CVE-2021-41127

CVE-2021-41127 affects Rasa, an open-source machine learning framework, allowing a malicious actor to craft a specially designed model.tar.gz file. This file can overwrite or replace critical bot files within the bot directory, potentially leading to unauthorized modifications or denial of service. The vulnerability carries a CVSS score of 7.1 (HIGH), indicating a significant risk. It requires user interaction (UI:R) and local access (AV:L), but once exploited, it can lead to high integrity and availability impacts (I:H/A:H). There is currently no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE. Users are advised to update to Rasa 2.8.10 or implement mitigation strategies by restricting untrusted model uploads and limiting CLI/API access.